Port 8333 – Bitcoin

TCP

Port 8333 is the Bitcoin mainnet peer-to-peer port. Full nodes listen on port 8333 to relay transactions and blocks to other nodes. Running a Bitcoin node on port 8333 is resource-intensive (500+ GB blockchain, significant bandwidth). Testnet uses port 18333. Port 8333 is not a security risk – it serves only the P2P protocol.

Port Number

8333

Protocol

TCP

Service

Bitcoin P2P Network

Range

IANA Registered (1024–49151)

Description

Bitcoin Core and compatible full node implementations listen on TCP port 8333 for peer connections on the Bitcoin mainnet. Nodes exchange inventory vectors, relay unconfirmed transactions, propagate new blocks, and synchronize the blockchain. Each node maintains connections to 8-125 peers. Port 8333 exposure is by design – the Bitcoin network requires public nodes for decentralization. The P2P protocol on port 8333 does not expose wallet keys or enable fund theft. The separate RPC interface (default port 8332, localhost only) is the sensitive port that controls the wallet. Ensure RPC remains bound to 127.0.0.1 with strong authentication. The JSON-RPC port (8332) should never be exposed to the internet.

Security risks

1Eclipse attacks: an attacker fills all of a node's peer slots (default 125 inbound) with attacker-controlled nodes via port 8333, isolating the victim from the real network. The eclipsed node sees only attacker-supplied blocks/transactions, enabling double-spend attacks against merchants using that node for confirmation.
2CVE-2018-17144: Bitcoin Core inflation bug – a specially crafted transaction could crash nodes or (in some versions) create coins from nothing. Nodes accepting connections on 8333 could be crashed remotely by sending the malicious block. Fixed in Bitcoin Core 0.16.3.
3RPC port confusion (CRITICAL): port 8332 (JSON-RPC) controls the wallet – sendtoaddress, dumpprivkey, and all fund operations. If 8332 is accidentally exposed instead of 8333, attackers drain the wallet instantly. RPC must remain on 127.0.0.1 with strong rpcauth credentials.
4Network topology fingerprinting: analyzing connection patterns and transaction relay timing on port 8333 can deanonymize which node originated a transaction (linking IP to Bitcoin address). Tor/I2P routing mitigates this.
5Memory exhaustion via inv flooding: attackers can send massive inventory messages (INV) over port 8333 to consume node memory. Bitcoin Core implements per-peer limits but older or alternative implementations may not.

Firewall guidance

Port 8333 SHOULD be open inbound for running a full node – this strengthens the Bitcoin network and enables faster block/transaction relay. It is safe to expose: the P2P protocol cannot access wallet funds. Port 8332 (RPC) must NEVER be exposed: bind to 127.0.0.1 only (rpcbind=127.0.0.1 in bitcoin.conf). If running both a node and Lightning (LND/CLN), ensure LN ports (9735) are also separate from RPC.

Diagnosis commands

Show peer count and how your node is reachable (verify port 8333 is advertised)

shell

bitcoin-cli getnetworkinfo | jq '{connections, localaddresses}'

Count connected peers (healthy node: 8-20 outbound, up to 125 inbound)

shell

bitcoin-cli getpeerinfo | jq '.[].addr' | wc -l

Verify only P2P (8333) is exposed, RPC (8332) is closed from outside

shell

nmap -p 8332,8333 --open target

Check sync status (1.0 = fully synced)

shell

bitcoin-cli getblockchaininfo | jq '{blocks, headers, verificationprogress}'

Usage examples

Port 8333 – Bitcoin

shell

bitcoin-cli getpeerinfo | jq '.[].addr'
bitcoin.conf: port=8333
nmap -p 8333 --script bitcoin-info target

Common services on this port

Bitcoin CorebtcdBitcoin KnotsLibbitcoin ServerUmbrel/RaspiBlitz (node packages)

Related ports

8332

Bitcoin JSON-RPC (wallet control – NEVER expose)

18333

Bitcoin testnet P2P

18332

Bitcoin testnet RPC

38333

Bitcoin signet P2P

History

Bitcoin was released by Satoshi Nakamoto on January 3, 2009. Port 8333 was hardcoded in the original Bitcoin software as the mainnet P2P port. The choice appears arbitrary (no known significance). Testnet uses 18333 (10000 + 8333). The P2P protocol has evolved significantly: version handshake, compact blocks (BIP 152, 2016), Erlay (2023) for bandwidth-efficient transaction relay, and v2 encrypted transport (BIP 324, 2023) which encrypts all P2P traffic on port 8333.

FAQ

Is it safe to expose port 8333 to the internet?

Yes. Port 8333 serves only the Bitcoin P2P protocol – it cannot access your wallet, private keys, or funds. Exposing 8333 makes you a full node that helps the network (relays blocks/transactions to other nodes). The dangerous port is 8332 (JSON-RPC) which controls wallet operations – that must stay on localhost only. This distinction is the single most important thing to understand about Bitcoin node security.

What is BIP 324 (v2 transport) and does it change port 8333?

BIP 324 (merged in Bitcoin Core 26.0, 2023) encrypts all P2P communication on port 8333 using the Noise Protocol Framework. Same port, but traffic is no longer plaintext. Benefits: ISPs cannot see you run a Bitcoin node (just encrypted TCP on 8333), prevents packet injection/modification, and makes eclipse attacks harder. Nodes auto-negotiate v2 when both peers support it.